Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Sat, 21 Sep 2002 23:34:21 +0200

So here's how I see this working:

1) Old AR and new AR have a security association.

2) Old AR and new AR exchange HI/HaCK with old CoA and L2 id of MN about
to
undergo handover. New AR agrees to handle the tunnel.

3) New AR inserts a source route, and simultaneously modifies its
ingress filter
so that packets from old CoA originating on the air interface side will
get
routed into the tunnel interface.

4) MN shows up on new link, starts sending all packets with old CoA to
new AR.

5) New AR checks against source routes, old CoA matches, link layer
address
matches, routes down the tunnel.

Let's consider some attacks:

1) Attacker on the air interface side starts sending packets with the
old CoA
and the link layer address (both need to be spoofed in order to pass the
ingress
filter). The router will route down the tunnel.

2) Attacker on the air interface side starts sending packets with a
vaild CoA on
the subnet and a valid link layer address of another node on the subnet.
The
router routes the packet out.

So I guess I don't see much difference. Or did you have a different
threat in
mind?

=> Threat 1 is what I had in mind. Like I said there
is a difference. The difference is: ingress filtering
_stops_ threat 1). We're violating that. 

As Section 1 of RFC 2267 says:

   While the filtering method discussed in this document does
   absolutely nothing to protect against flooding attacks which
   originate from valid prefixes (IP addresses), it will prohibit an
   attacker within the originating network from launching an attack of
   this nature using forged source addresses that do not conform to
   ingress filtering rules.

=> That's exactly what I've been saying.

The source route makes the old CoA a valid (/128) prefix on the subnet,
because
it is established by a secure transaction between the routers.

=> The point is, the secure transaction between
routers is irrelevant to this discussion. What
you're saying above can be reworded to say:
"The source route makes the old CoA a valid (/128) prefix on the 
subnet, hence allowing for new attacks that ingress filtering
is meant to stop". 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Mon, 23 Sep 2002 14:51:09 -0700

The ingress filter won't stop someone spoofing a /64 on the subnet. It also
won't stop someone from spoofing a /128.

So what I am saying is that ingress filtering is irrelevent to this discussion.
An attacker can spoof a valid prefix on the subnet regardless of whether it is a
/64 or a /128. Once the /128 has been securely set up, it is like any other
address on the link. There is currently no way for a router to determine whether
a node claiming to have the right to use a particular address does, in fact,
have that right. CGA and some of the other techniques we are talking about in
the SEND discussion may, in fact, provide this capability. If so, then the
ability of a node to spoof any address on the link will be removed because the
router can check whether it has the right to claim the address

What exactly am I missing here?

            jak

----- Original Message -----
From: "Hesham Soliman (EAB)" <[email-masked]>
To: "'James Kempf '" <[email-masked]>; "Hesham Soliman (EAB)"
<[email-masked]>; <[email-masked]>
Sent: Saturday, September 21, 2002 2:34 PM
Subject: RE: [mobile-ip] fastv6 and CoAs